Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 53 of 73
Dec 13, 2018Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field wCVE-2018-19118 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain.
- Product
- Manageengine Adaudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Dec 13, 2018PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.CVE-2018-20138 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
- Product
- Entrepreneur B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Dec 10, 2018PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.CVE-2018-20012 · Websites & servers · Phpcmf · reported by MITREMedium 4.8
PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
- Product
- Phpcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.CVE-2018-20011 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.CVE-2018-20010 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.CVE-2018-20009 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.CVE-2018-19915 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.CVE-2018-19914 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.CVE-2018-19913 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 5, 2018DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.CVE-2018-19892 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.CVE-2018-19877 · Other software · Adiscon · reported by MITREMedium 6.1
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
- Product
- Loganalyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordloganalyzer.adiscon.comexploit-db.com
Dec 4, 2018In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 requesCVE-2018-17158 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.5
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Nov 30, 2018PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.CVE-2018-19785 · Websites & servers · Php-proxy · reported by MITREMedium 6.1
PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.
- Product
- Php-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2018i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.CVE-2018-19527 · Other software · I4 · reported by MITREMedium 6.1
i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.
- Product
- AI SI Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.CVE-2018-19752 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.CVE-2018-19751 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.CVE-2018-19750 · Other software · Domainmod · reported by MITREMedium 5.4
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.CVE-2018-19749 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentCVE-2018-16089 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.5
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 22, 2018Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party statCVE-2018-19464 · Other software · Dismall · reported by MITREMedium 4.8
Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
- Product
- Discuz!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.CVE-2018-19324 · Other software · Kimsq · reported by MITREMedium 5.4
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
- Product
- RB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > SCVE-2018-19311 · Other software · Centreon · reported by MITREMedium 5.4
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordroothc.com.brdocumentation.centreon.com
Nov 11, 2018In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name pCVE-2018-19170 · Other software · Jpress · reported by MITREMedium 4.8
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
- Product
- Jpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.CVE-2018-18892 · Other software · 1234n · reported by MITRECritical 9.8
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).CVE-2018-18887 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.CVE-2018-18743 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.CVE-2018-18740 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.CVE-2018-18739 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2018Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.CVE-2018-18553 · Other software · Leanote · reported by MITREMedium 6.1
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2018Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.CVE-2018-12374 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Oct 16, 2018A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.CVE-2018-18307 · Other software · Alchemy-cms · reported by MITREMedium 6.1
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."
- Product
- Alchemy CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 9, 2018The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page.CVE-2018-18198 · Other software · Redaxo · reported by MITREMedium 6.1
The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request.
- Product
- Redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.CVE-2018-18029 · Other software · Naviwebs · reported by MITREMedium 5.4
Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.
- Product
- Navigate CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
- Product
- wp-slimstat (aka Slimstat Analytics)
- Fixed in
- 4.1.6.1
- What to do
- Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 5, 2018The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.CVE-2014-10075 · Other software · Karo Project · reported by MITRECritical 9.8
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.
- Product
- Karo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvapid.dhs.orgvapidlabs.com
Oct 1, 2018The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.CVE-2018-15702 · Network & remote access · TP-Link · reported by vulnreport@tenable.comHigh 8.8
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.
- Product
- TP-Link TL-WRN841N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 28, 2018Vanilla before 2.6.1 allows XSS via the email field of a profile.CVE-2018-17571 · Other software · Vanillaforums · reported by MITREMedium 6.1
Vanilla before 2.6.1 allows XSS via the email field of a profile.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 21, 2018Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.CVE-2018-16833 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 21, 2018The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.CVE-2018-16281 · Other software · Deiser · reported by MITRECritical 9.8
The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.
- Product
- Profields-project Custom Fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarketplace.atlassian.commarketplace.atlassian.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3915 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.2
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3914 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 7.8
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 2000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3913 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comMedium 6.7
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to exploit this vulnerability.
- Product
- Sth-eth-250 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub.CVE-2018-3906 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.2
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message.CVE-2018-17302 · Other software · Espocrm · reported by MITREMedium 5.4
Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.CVE-2018-17301 · Other software · Espocrm · reported by MITREMedium 5.4
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2018LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.CVE-2018-16752 · Other software · Linknet-usa · reported by MITREHigh 8.8
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
- Product
- Lw-n605r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 19, 2018Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive inCVE-2018-3830 · Other software · Elastic · reported by security@elastic.coMedium 6.1
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comdiscuss.elastic.co
Sep 17, 2018The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.CVE-2018-17138 · WordPress plugins & themes · reported by MITREMedium 5.4
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
- Product
- Jibu Pro
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Jibu Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 17, 2018admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.CVE-2018-17134 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.CVE-2018-17131 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.